| 192 |
- |
1 |
#%PAM-1.0
|
|
|
2 |
# this MUST be first in the "auth" stack as it sets PAM_USER
|
|
|
3 |
# user_unknown is definitive, so die instead of ignore to avoid subsequent modules mess up the error code
|
|
|
4 |
-auth [success=done new_authtok_reqd=done user_unknown=die default=ignore] pam_cockpit_cert.so
|
|
|
5 |
auth required pam_sepermit.so
|
|
|
6 |
auth substack password-auth
|
|
|
7 |
auth include postlogin
|
|
|
8 |
auth optional pam_ssh_add.so
|
|
|
9 |
account required pam_nologin.so
|
|
|
10 |
account include password-auth
|
|
|
11 |
password include password-auth
|
|
|
12 |
# pam_selinux.so close should be the first session rule
|
|
|
13 |
session required pam_selinux.so close
|
|
|
14 |
session required pam_loginuid.so
|
|
|
15 |
# pam_selinux.so open should only be followed by sessions to be executed in the user context
|
|
|
16 |
session required pam_selinux.so open env_params
|
|
|
17 |
session optional pam_keyinit.so force revoke
|
|
|
18 |
session optional pam_ssh_add.so
|
|
|
19 |
session include password-auth
|
|
|
20 |
session include postlogin
|